Executive brief
Undici is a popular HTTP client library for Node.js used by many applications to make web requests. The library fails to properly deduplicate HTTP headers when they are provided with case-variant names (e.g., "Content-Length" and "content-length"), allowing attackers to craft requests with conflicting Content-Length values. This can lead to request smuggling attacks where intermediaries (proxies, firewalls) and backend servers interpret the request differently, enabling cache poisoning, credential theft, or unauthorized access.
Technical details
The vulnerability is classified as CWE-444 (HTTP Request/Response Smuggling). Undici fails to normalize HTTP header names to a canonical case when checking for duplicates, allowing an attacker to provide both "Content-Length" and "content-length" headers in an array-format header specification. This results in malformed HTTP/1.1 requests with multiple conflicting Content-Length values being sent on the wire. The vulnerability affects applications using low-level APIs like undici.request() or undici.Client with headers passed as flat arrays. No authentication is required; the attack is triggered when user-controlled header names are passed without case normalization. Exploitation can lead to denial of service (strict parsers reject the malformed request) or HTTP request smuggling (where intermediaries and backends interpret duplicate headers inconsistently, enabling ACL bypass, cache poisoning, or credential hijacking). Patches are available in versions 6.24.0 and 7.24.0.
Affected products
- nodejs undici < 6.24.0; 7.0.0 <= 7.23.x
Timeline
- 2026-03-13: disclosed: Advisory GHSA-2mjp-6q6p-2qxm published
- 2026-03-13: patched: Fixed in undici v6.24.0 and v7.24.0